Anti-virus software was very easy to circumvent in the past. Getting the kernel32 address from the PEB, having your own PE loader and having most code xored with the Mersenne twister output in the data segment for obfuscation, as well as some runtime is_sandbox() heuristics and no AV would detect anything malicious.
Don't know if it got better or worse, but AV software was not very good at finding malicious code explicitly written to not run in plain sight in the past.
Having Windows Defender on is sufficient for the casual threats most people would encounter.
And for many things WD is simply much better than any solution this includes offline removal of rootkits (it can boot into a WinPE environment for a scan) and Ransomware protection where Windows Defender can restrict apps from accessing folders that tend to keep user data: https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/...
Basically if you have Windows 7, 8 or 10 keep Windows Defender on it actually does work.
This sounds much like survivorship bias to me.
So unless you going to say that vaccination is survivorship bias because we don't have them against some diseases I really don't see your point.
Windows Defender will block virtually every common infection these are what most people get hit by, it will also block virtually all ransomware and you can see just how much the ransomware "market" got hit once they implemented it to see that it is effective.
Yes it won't protect you against NSA or some high end hacking group that writes completely custom malware to target single individuals but you are also not likely being the target of these.
But you are likely be target of the 1000's of known threats that are spread through driveby attacks, infected media and pretty old stuff you'll be surprised just how common 5 year old infections still are.
If you share removeable media with other people and have people who use your computer or on your network that aren’t exactly security conscious it’s not a terrible idea to have it enabled.